Security audit

danger-guard

Security checks for vulnerabilities and agentic risk

Overview

This is a defensive command guard, but it asks users to enter their OS password into chat and persistently rewrites agent instruction files.

Review before installing. Do not enter your real sudo, admin, or login password into an AI chat, and avoid enabling the shell wrapper unless you accept persistent interception of common terminal commands. If you use this concept, prefer native OS authorization and scoped, reversible project-local rules instead of global memory, AGENTS.md, shell aliases, and unsalted password hashes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:221
Finding: Persistent modification of mandatory Agent instructions and long-term memory
Content: View full analysis
request login password -> verify SHA-256 hash -> execute only after verification -> send an alert. - Configuration file: memory/danger-guard-config.json - Trigger whenever rm appears, regardless of whether the command is complete. - See skills/danger-guard/SKILL.md. Step 2: Write to AGENTS.md Insert the mandatory rule block at the top of AGENTS.md. Do not determine whether the command is complete or whether the intent is safe. Intercept whenever a listed keyword appears. ``` The behavior is also advertised in `README.md:139-149`: ```markdown After installation, Danger Guard automatically writes interception rules into your agent's mandatory-read files: | Target File | What Gets Written | Why | | `MEMORY.md` | Danger keyword shortcuts at the top | Loaded every session, highest priority | | `AGENTS.md` | Full keyword trigger list | Behavior rules layer | ``` ### Technical Analysis The Skill does not keep its rules confined to its own execution context. It directs the Agent to alter `MEMORY.md` and `AGENTS.md`, which are persistent, high-priority instruction sources loaded during future sessions. The inserted rules explicitly prohibit contextual evaluation and activate solely on keyword presence. This creates a du ...[truncated 1647 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:176
Finding: Unsafe collection and weak storage of the user's operating-system password
Content: View full analysis
Stored as SHA256 hash, never plaintext ``` The configuration format persists the resulting verifier: ```json { "os": "macOS", "sudo_hash": "sha256:...", "alert_email": null, "email_method": "none", "enabled": true } ``` ### Technical Analysis The Skill asks the user to disclose the real sudo, administrator, or login password through an AI-mediated conversation. Even if the value is immediately hashed, the plaintext must first pass through the chat interface, Agent context, application process, and potentially conversation logs, telemetry, plugins, or messaging-platform storage. Plain SHA-256 is also inappropriate for password storage because it is fast and, as documented, lacks a unique salt and a password-hardening work factor. An attacker who obtains `sudo_hash` can perform efficient offline dictionary or brute-force guessing. A recovered password may be valid for local login, sudo authorization, disk decryption, password reuse on other services, or other privileged operations. The claim that this design is equivalent to PAM or macOS Keychain is technically inaccurate. Secure operating-system authentication normally delegates verification ...[truncated 1547 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: INSTALL.md:101
Finding: Persistent hijacking of common shell commands through startup-file aliases
Content: View full analysis
> ~/.bashrc source ~/.bashrc echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc source ~/.zshrc ``` ```bash alias rm='danger-guard rm' alias mv='danger-guard mv' alias find='danger-guard find' alias dd='danger-guard dd' alias mkfs='danger-guard mkfs' alias chmod='danger-guard chmod' alias chown='danger-guard chown' alias shutdown='danger-guard shutdown' alias reboot='danger-guard reboot' alias git='danger-guard git' alias docker='danger-guard docker' alias docker-compose='danger-guard docker-compose' ``` ### Technical Analysis The installation procedure modifies persistent shell startup files and redirects standard utilities through a wrapper. Once loaded, commands that appear to invoke legitimate tools instead invoke `danger-guard` first. This creates a durable interception layer for unrelated terminal activity, not merely commands initiated by the AI Agent. It also places `~/.local/bin` at the front of `PATH`, which increases the security impact of any malicious or accidentally replaced executable in that directory. Aliasing broad tools such as `git`, `docker`, `chmod`, `find`, and `rm` exceeds the minimum scope required for project-local AI command protection. It also creates an attractive hijacking point because future modifications to the wrapper transparently affect commands the user believes are standard utilities. The audited artifact references `configs/shell-wrapper/danger-guard`, but that file is absent from the supplied project. Consequently, the documented interception behavior cannot be fully reviewed or safely installed from this artifact. ### Attack Path 1. The user accepts optional shell-wrapper installation. 2. Installation append ...[truncated 1236 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:444
Finding: Arbitrary command injection through eval in the documented shell wrapper
Content: View full analysis
/dev/null) if [[ "$HASH" == "$STORED_HASH" ]]; then eval "$CMD" else exit 1 fi exit 0 fi done exec "$@" ``` ### Technical Analysis `CMD="$*"` flattens the original argument vector into a single string and loses argument-boundary information. `eval "$CMD"` then asks the shell to parse that string as new shell source code. As a result, shell control operators, redirections, substitutions, quoting constructs, and command separators contained in arguments are interpreted a second time. Password verification does not make this safe; it only gates entry into the vulnerable execution sink. An attacker able to influence the wrapped command can include a substring that matches a guarded pattern and append shell syntax. After an authorized user supplies the password, the entire reconstructed string is evaluated rather than executing only the intended binary with its original arguments. The pattern matching is also substring-based and does not parse the executable, options, operands, redirections, or command boundaries. ### Attack Path 1. An attacker supplies or influences arguments passed to the wrapper. 2. The argument string includes a listed dangerous pattern so that the verificat ...[truncated 1038 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (233)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · INSTALL.md (reported line 108)May include surrounding context.
（可选，推荐高级用户使用）。

安装步骤

创建本地 bin 目录（如果不存在）：

bash
mkdir -p ~/.local/bin

复制 danger-guard 脚本：

bash
cp /path/to/danger-guard/configs/shell-wrapper/danger-guard ~/.local/bin/danger-guard chmod +x ~/.local/bin/danger-guard

添加到 PATH：

bash
# 对于 bash echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc source ~/.bashrc # 对于 zsh echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc source ~/.zshrc

配置命令别名（保护特定命令）：

bash
# 对于 bash cat >> ~/.bashrc << 'EOF' # Danger Guard 保护 alias rm='danger-guard rm' alias mv='danger-guard mv' alias find='danger-guard find' alias dd='danger-guard dd' alias mkfs='danger-guard mkfs' alias chmod='danger-guard chmod' alias chown='danger-guard chown' alias shutdown='danger-guard shutdown' alias r

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Storing a sudo-password-derived hash in a local config file introduces credential-adjacent material unrelated to simple command blocking. Even if hashed, it enables offline guessing and creates a new secret-management surface in the user's home directory, making the skill more dangerous than its stated protective purpose suggests.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 79% confidence
Finding: This duplicate finding points to the same force-push bypass guidance. The context makes it more dangerous because the skill is marketed as a guardrail, yet the document teaches users how to disable it transiently to perform the exact blocked action.
Content: Scanner excerpt · INSTALL.md (reported line 223)May include surrounding context.

绕过方法: 如果确实需要 force push，可以临时重命名 hook：
bash
mv .git/hooks/pre-push .git/hooks/pre-push.bak git push --force mv .git/hooks/pre-push.bak .git/hooks/pre-push

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 79% confidence
Finding: This duplicate finding points to the same force-push bypass guidance. The context makes it more dangerous because the skill is marketed as a guardrail, yet the document teaches users how to disable it transiently to perform the exact blocked action.
Content: Scanner excerpt · INSTALL.md (reported line 223)May include surrounding context.

绕过方法: 如果确实需要 force push,可以临时重命名 hook:
bash
mv .git/hooks/pre-push .git/hooks/pre-push.bak git push --force mv .git/hooks/pre-push.bak .git/hooks/pre-push

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALL.md (reported line 247)May include surrounding context.
在终端中执行：

bash
rm -rf /tmp/test

应该看到 Danger Guard 警告并要求输入 sudo 密码。

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALL.md (reported line 268)May include surrounding context.
卸载 Claude Code 配置

bash
rm .claude/settings.json # 如果 CLAUDE.md 只包含 Danger Guard 规则： rm CLAUDE.md

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALL.md (reported line 290)May include surrounding context.
bash
# 删除脚本 rm ~/.local/bin/danger-guard # 从 shell 配置中移除 PATH 和别名 # 编辑 ~/.bashrc 或 ~/.zshrc，删除相关行

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALL.md (reported line 304)May include surrounding context.
bash
# 单个仓库 rm .git/hooks/pre-push # Git 模板 rm ~/.git-templates/hooks/pre-push

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALL.md (reported line 307)May include surrounding context.
rm .git/hooks/pre-push

Git 模板

rm ~/.git-templates/hooks/pre-push git config --global --unset init.templatedir

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PROMO.md (reported line 14)May include surrounding context.
Text:

text
Your AI assistant has full access to your machine. If someone compromises your messaging account (Feishu, Telegram, Discord, etc.), they can tell your AI to run rm -rf /, format C:, or git push --force. The AI just does it. Danger Guard solves this by detecting 100+ dangerous commands across Linux, macOS, and Windows, requiring sudo/admin password verification, and sending alerts to your messaging platform and email.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PROMO.md (reported line 58)May include surrounding context.
Text:

text
Your AI assistant has full access to your machine. If someone compromises your messaging account (Feishu, Telegram, Discord, etc.), they can tell your AI to run rm -rf /, format C:, or git push --force. The AI just does it. Danger Guard solves this by detecting 100+ dangerous commands across Linux, macOS, and Windows, requiring sudo/admin password verification, and sending alerts to your messaging platform and email.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PROMO.md (reported line 14)May include surrounding context.
Text:

text
Your AI assistant has full access to your machine. If someone compromises your messaging account (Feishu, Telegram, Discord, etc.), they can tell your AI to run rm -rf /, format C:, or git push --force. The AI just does it. Danger Guard solves this by detecting 100+ dangerous commands across Linux, macOS, and Windows, requiring sudo/admin password verification, and sending alerts to your messaging platform and email.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · PROMO.md (reported line 14)May include surrounding context.
nal Content

Hacker News

Title:

text
Show HN: Safety shield for AI agents that intercepts dangerous commands before execution

URL: https://github.com/Thomaszhou22/danger-guard-skill

Text:

text
Your AI assistant has full access to your machine. If someone compromises your messaging account (Feishu, Telegram, Discord, etc.), they can tell your AI to run rm -rf /, format C:, or git push --force. The AI just does it. Danger Guard solves this by detecting 100+ dangerous commands across Linux, macOS, and Windows, requiring sudo/admin password verification, and sending alerts to your messaging platform and email. Works with OpenClaw, Claude Code, Cursor, Codex, and any AI tool. Optional system-level shell wrapper for full terminal protection. The core idea: AI agents need a safety layer between them and the system, especially when they can be controlled remotely through potentially compromised channels. Feedback welcome on command patterns I might have missed.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PROMO.md (reported line 32)May include surrounding context.
Body:

text
Been running an AI assistant that has full access to my machine through OpenClaw. Realized if my Feishu/Telegram account gets compromised, someone could tell my AI to rm -rf / and it would just do it. So I built Danger Guard - a safety layer that:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PROMO.md (reported line 58)May include surrounding context.
md
I built Danger Guard - it intercepts dangerous commands before they execute: - Filesystem destruction (rm -rf /, format C:) - Disk operations (dd, mkfs) - Git force pushes - Docker system prune

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PROMO.md (reported line 93)May include surrounding context.
Post:

text
Your AI assistant can rm -rf / if someone hacks your messaging account. Built Danger Guard to fix this: - Intercepts 100+ dangerous commands

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README-CN.md (reported line 17)May include surrounding context.
md
## 问题你的 AI 助手拥有机器的完整权限。如果有人盗取了你的通讯账号——飞书、Telegram、Discord、WhatsApp 等——他们可以告诉 AI 执行 `rm -rf /`、`format C:` 或 `git push --force`。AI 会直接执行。 Danger Guard 阻止这一切。

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README-CN.md (reported line 93)May include surrounding context.
md
- `history | sh` **Remote code execution:** - `curl ... | sh`, `curl ... | bash` - `wget ... | sh`, `wget ... | bash` - `powershell iwr ... | iex`

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 93)May include surrounding context.
md
- `history | sh` **Remote code execution:** - `curl ... | sh`, `curl ... | bash` - `wget ... | sh`, `wget ... | bash` - `powershell iwr ... | iex`

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.
md
- `history | sh` **Remote code execution:** - `curl ... | sh`, `curl ... | bash` - `wget ... | sh`, `wget ... | bash` - `powershell iwr ... | iex`

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README-CN.md (reported line 93)May include surrounding context.
md
- `history | sh` **Remote code execution:** - `curl ... | sh`, `curl ... | bash` - `wget ... | sh`, `wget ... | bash` - `powershell iwr ... | iex`

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 93)May include surrounding context.
md
- `history | sh` **Remote code execution:** - `curl ... | sh`, `curl ... | bash` - `wget ... | sh`, `wget ... | bash` - `powershell iwr ... | iex`

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README-CN.md (reported line 94)May include surrounding context.
md
**Remote code execution:** - `curl ... | sh`, `curl ... | bash` - `wget ... | sh`, `wget ... | bash` - `powershell iwr ... | iex` ### Tier 2 — Blocked With Confirmation

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 94)May include surrounding context.
md
**Remote code execution:** - `curl ... | sh`, `curl ... | bash` - `wget ... | sh`, `wget ... | bash` - `powershell iwr ... | iex` ### Tier 2 — Blocked With Confirmation

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README-CN.md (reported line 94)May include surrounding context.
md
**Remote code execution:** - `curl ... | sh`, `curl ... | bash` - `wget ... | sh`, `wget ... | bash` - `powershell iwr ... | iex` ### Tier 2 — Blocked With Confirmation

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T05 · Unauthorized Access and Privilege Escalation

T06 · System Persistence

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

安装步骤

Context-Inappropriate Capability

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

卸载 Claude Code 配置

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Git 模板

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

Hacker News

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

Static analysis